feat: umfangreiches UI+API-Polish (v1.1.36–1.1.42)
Backend: - Audit-Log: Search-Endpoint mit ILIKE-Filter (actor/action/subject/date) - NTP: /ntp/status via chronyc tracking (Stratum, Offset, Quelle) - System: /service-restart mit Allowlist (haproxy/squid/unbound/chrony/scheduler) - Domain-Response-Headers + Rate-Limit (Migration 0024) - Join-Tokens (Migration 0025), Cluster-mTLS, Aggregator-Fan-Out - apt-Service für Update-Banner (apt-get update + Versionsprüfung) - Backup-Retry mit exponential backoff (retry_apt 3×) - publish.sh fail-fast + cleanup-old.sh (max 10 Versionen) Frontend: - Audit-Log-Page (/audit) mit Filter + Pagination - ErrorBoundary an React-Root + Vite build-target festgenagelt (iOS 15+) - Storage-Schema-Stamp: auto-wipe bei Versions-Mismatch (blank-page-Fix) - EmptyState-Komponente überall ausgerollt - SSL: Aggregate-Karte (total/expiring/expired/errors) - Backups: Aggregate-Karte (letzter Backup/Größe/Fehlschläge 24h) + Backup-Now - NTP: Sync-Status-Karte (chronyc tracking live) - Domains: Backend-UP/DOWN-Chip aus HAProxy-Stats - Backends: HAProxy-Status-Spalte (UP/DEGRADED/DOWN) - Settings: Service-Neustart-Karte (haproxy/squid/unbound/chrony/scheduler) - Settings: Upgrade-Status-Card, Wartungsmodus, Auto-Update, Retention - Dashboard: Recent-Alerts, Cluster-Health, License-Chip, Onboarding-Hint - System-Regeln im Firewall als eigener Tab Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Debian
@@ -20,6 +20,7 @@
|
||||
"firewallLive": "Firewall-Log",
|
||||
"cluster": "Cluster",
|
||||
"logs": "Logs",
|
||||
"audit": "Audit-Log",
|
||||
"backups": "Backups",
|
||||
"diagnostics": "Diagnose",
|
||||
"alerts": "Alarme",
|
||||
@@ -44,7 +45,8 @@
|
||||
"addrObj": "Adress-Objekte",
|
||||
"addrGrp": "Adress-Gruppen",
|
||||
"services": "Services",
|
||||
"svcGrp": "Service-Gruppen"
|
||||
"svcGrp": "Service-Gruppen",
|
||||
"system": "System-Regeln"
|
||||
},
|
||||
"zone": {
|
||||
"name": "Name",
|
||||
@@ -55,31 +57,41 @@
|
||||
"namePattern": "Nur Kleinbuchstaben, Ziffern, _ und -; muss mit Buchstaben beginnen, max. 32 Zeichen.",
|
||||
"add": "Zone hinzufügen",
|
||||
"edit": "Zone bearbeiten",
|
||||
"deleteConfirm": "Zone {{name}} wirklich löschen?"
|
||||
"deleteConfirm": "Zone {{name}} wirklich löschen?",
|
||||
"emptyTitle": "Noch keine eigenen Firewall-Zonen.",
|
||||
"emptyDesc": "Zonen gruppieren Interfaces (lan, wan, dmz). Vordefinierte Zonen sind bereits da; eigene anlegen wenn du z. B. eine separate dmz-Zone oder eine wg-Zone fürs VPN brauchst."
|
||||
},
|
||||
"ao": {
|
||||
"name": "Name", "kind": "Typ", "value": "Wert", "description": "Beschreibung",
|
||||
"add": "Adress-Objekt hinzufügen", "edit": "Adress-Objekt bearbeiten",
|
||||
"deleteConfirm": "Adress-Objekt {{name}} wirklich löschen?"
|
||||
"deleteConfirm": "Adress-Objekt {{name}} wirklich löschen?",
|
||||
"emptyTitle": "Noch keine Adress-Objekte.",
|
||||
"emptyDesc": "Wiederverwendbare benannte IPs/Netze/Ranges für Firewall- und NAT-Regeln (z. B. office-net = 10.0.0.0/24, mailbox-1 = 10.0.1.42)."
|
||||
},
|
||||
"ag": {
|
||||
"name": "Name", "members": "Mitglieder", "description": "Beschreibung",
|
||||
"add": "Adress-Gruppe hinzufügen", "edit": "Adress-Gruppe bearbeiten",
|
||||
"selectMembers": "Adress-Objekte wählen",
|
||||
"deleteConfirm": "Adress-Gruppe {{name}} wirklich löschen?"
|
||||
"deleteConfirm": "Adress-Gruppe {{name}} wirklich löschen?",
|
||||
"emptyTitle": "Noch keine Adress-Gruppen.",
|
||||
"emptyDesc": "Bündele mehrere Adress-Objekte zu einer Gruppe (z. B. office-locations = [hq-net, branch-1-net, branch-2-net]) — Regeln müssen dann nur eine Gruppe referenzieren."
|
||||
},
|
||||
"svc": {
|
||||
"name": "Name", "proto": "Protokoll", "ports": "Ports",
|
||||
"portStart": "Port (Start)", "portEnd": "Port (Ende)",
|
||||
"description": "Beschreibung", "builtinHint": "Vordefiniert — nicht editierbar",
|
||||
"add": "Service hinzufügen", "edit": "Service bearbeiten",
|
||||
"deleteConfirm": "Service {{name}} wirklich löschen?"
|
||||
"deleteConfirm": "Service {{name}} wirklich löschen?",
|
||||
"emptyTitle": "Noch keine eigenen Services.",
|
||||
"emptyDesc": "Vordefinierte (HTTP, HTTPS, SSH, …) sind bereits da. Eigene Services für app-spezifische Ports (z. B. mailcow-imaps tcp/993) erleichtern Regeln deutlich."
|
||||
},
|
||||
"sg": {
|
||||
"name": "Name", "members": "Mitglieder", "description": "Beschreibung",
|
||||
"add": "Service-Gruppe hinzufügen", "edit": "Service-Gruppe bearbeiten",
|
||||
"selectMembers": "Services wählen",
|
||||
"deleteConfirm": "Service-Gruppe {{name}} wirklich löschen?"
|
||||
"deleteConfirm": "Service-Gruppe {{name}} wirklich löschen?",
|
||||
"emptyTitle": "Noch keine Service-Gruppen.",
|
||||
"emptyDesc": "Bündele mehrere Services zu einer Gruppe (z. B. web-stack = [HTTP, HTTPS, HTTP/3]) — eine Regel mit der Gruppe ersetzt drei Regeln pro Service."
|
||||
},
|
||||
"rule": {
|
||||
"name": "Name", "priority": "Priority", "enabled": "Aktiv", "log": "Logging",
|
||||
@@ -90,7 +102,9 @@
|
||||
"serviceKind": "Service-Typ", "serviceGroup": "Service-Gruppe",
|
||||
"comment": "Kommentar",
|
||||
"add": "Regel hinzufügen", "edit": "Regel bearbeiten",
|
||||
"deleteConfirm": "Diese Regel wirklich löschen?"
|
||||
"deleteConfirm": "Diese Regel wirklich löschen?",
|
||||
"emptyTitle": "Noch keine eigenen Firewall-Regeln.",
|
||||
"emptyDesc": "Die System-Regeln oben halten SSH (rate-limited), HTTPS :443 und Mgmt-UI :3443 immer offen (Anti-Lockout). Eigene Regeln für app-spezifische Inbound-Ports oder zonenübergreifende Forwards anlegen."
|
||||
},
|
||||
"nat": {
|
||||
"name": "Name", "priority": "Priority", "kind": "Typ", "enabled": "Aktiv",
|
||||
@@ -102,7 +116,9 @@
|
||||
"targetAddr": "Ziel-Adresse", "targetPortStart": "Ziel-Port (Start)", "targetPortEnd": "Ziel-Port (Ende)",
|
||||
"comment": "Kommentar",
|
||||
"add": "NAT-Regel hinzufügen", "edit": "NAT-Regel bearbeiten",
|
||||
"deleteConfirm": "Diese NAT-Regel wirklich löschen?"
|
||||
"deleteConfirm": "Diese NAT-Regel wirklich löschen?",
|
||||
"emptyTitle": "Noch keine NAT-Regeln.",
|
||||
"emptyDesc": "DNAT (z. B. extern :2030 → intern 10.10.20.12:22 für SSH zu einem internen Host) oder SNAT/MASQUERADE (Internet-Zugang für ein internes Subnetz über die Box-IP)."
|
||||
},
|
||||
"sys": {
|
||||
"title": "System-Regeln (immer aktiv)",
|
||||
@@ -125,6 +141,8 @@
|
||||
"systemDiscovered": "System-Interfaces (read-only)",
|
||||
"addInterface": "Interface hinzufügen",
|
||||
"editInterface": "Interface bearbeiten",
|
||||
"emptyTitle": "Noch keine verwalteten Interfaces.",
|
||||
"emptyDesc": "System-Interfaces (siehe oben) werden read-only erkannt. Verwaltete Interfaces sind das was EdgeGuard selbst anlegt — VLANs, Bridges, Bond, GRE-Tunnels — und in /etc/network/interfaces.d rendert.",
|
||||
"name": "Name",
|
||||
"type": "Typ",
|
||||
"parent": "Parent-Interface",
|
||||
@@ -152,6 +170,8 @@
|
||||
"managedTitle": "Verwaltete Adressen",
|
||||
"family": "Familie",
|
||||
"addAddress": "Adresse hinzufügen",
|
||||
"emptyTitle": "Noch keine eigenen IP-Adressen.",
|
||||
"emptyDesc": "Lege deine erste IP an — Floating-VIPs für HA-Failover oder zusätzliche Listen-Adressen für HAProxy/Squid/Unbound. Box-eigene Distro-IPs werden oben unter \"Erkannte IPs\" gelesen.",
|
||||
"editAddress": "Adresse bearbeiten",
|
||||
"interface": "Interface",
|
||||
"selectInterface": "Interface wählen",
|
||||
@@ -192,12 +212,19 @@
|
||||
"setup": {
|
||||
"title": "Erst-Einrichtung",
|
||||
"intro": "Lege den Admin-Account an, gib die öffentliche FQDN an und – optional – einen Lizenzschlüssel. Ohne Lizenz startet eine 30-Tage-Trial.",
|
||||
"preflightTitle": "Vor dem Klick auf \"Setup abschließen\"",
|
||||
"preflightDesc": "Die FQDN muss bereits per DNS auf diese Box zeigen (A/AAAA-Record). Ohne DNS-Auflösung scheitert die spätere ACME-HTTP-01-Challenge — dein Browser-URL muss schon jetzt diese FQDN sein, sonst klemmt's spätestens beim ersten Let's-Encrypt-Issue.",
|
||||
"adminEmail": "Admin-E-Mail",
|
||||
"adminEmailHint": "Login-Identifier für die Management-UI. Wird NICHT für ausgehende Mails benutzt (das ist die ACME-E-Mail unten bzw. die SMTP-Settings im Alerts-Channel).",
|
||||
"adminPassword": "Admin-Passwort",
|
||||
"passwordRule": "Mindestens 12 Zeichen.",
|
||||
"fqdn": "Öffentliche FQDN",
|
||||
"fqdnHint": "Vollqualifizierter Hostname dieser Box (z. B. eg.example.com). Wird Subject-CN des Self-Signed-Bootstrap-Cert UND wandert in das ACME-Cert sobald Let's Encrypt ausgestellt hat. Muss per DNS auf die Public-IP zeigen.",
|
||||
"fqdnInvalid": "Sieht nicht wie eine gültige FQDN aus (mindestens label.tld).",
|
||||
"acmeEmail": "ACME-/Let's-Encrypt-E-Mail",
|
||||
"acmeEmailHint": "Wird Let's Encrypt als Account-Contact mitgegeben (Expiry-Warnungen + Compliance-Mails von LE). Kann gleich der Admin-E-Mail sein, muss aber nicht.",
|
||||
"licenseKey": "Lizenzschlüssel (optional)",
|
||||
"licenseKeyHint": "Wenn vorhanden: 30-Tage-Trial wird übersprungen, Features unmittelbar freigeschaltet. Kann auch später unter License nachgereicht werden.",
|
||||
"submit": "Setup abschließen",
|
||||
"successTitle": "Setup abgeschlossen",
|
||||
"successHint": "Du wirst zur Anmeldung weitergeleitet."
|
||||
@@ -211,14 +238,64 @@
|
||||
"intro": "Verwalte FQDNs, die HAProxy terminiert. Optionales Primary-Backend als Catch-all; Pfad-Routing via Routing-Regeln.",
|
||||
"addDomain": "Domain hinzufügen",
|
||||
"editDomain": "Domain bearbeiten",
|
||||
"emptyTitle": "Noch keine Domains.",
|
||||
"emptyDesc": "Lege deine erste Domain an — HAProxy terminiert dann TLS für diesen Hostnamen und routet an das gewählte Backend.",
|
||||
"name": "Name",
|
||||
"active": "Aktiv",
|
||||
"primaryBackend": "Primary-Backend",
|
||||
"primaryBackendHint": "Catch-all-Backend für Requests, die kein Routing-Regel-Match haben. Optional — leer lassen, wenn alles über Routing-Regeln läuft.",
|
||||
"selectBackend": "Backend wählen",
|
||||
"noBackend": "kein Backend",
|
||||
"quickBackendBtn": "+ neu",
|
||||
"quickBackendBtnHint": "Backend + ersten Upstream-Server in einem Klick anlegen — spart den Umweg über die Backends-Seite.",
|
||||
"quickBackendTitle": "Backend schnell anlegen",
|
||||
"quickBackendName": "Backend-Name",
|
||||
"quickBackendScheme": "Schema",
|
||||
"quickBackendAddress": "Server-Adresse (Erster Upstream)",
|
||||
"quickBackendPort": "Port",
|
||||
"quickBackendCreated": "Backend + Server angelegt und ausgewählt.",
|
||||
"quickBackendFailed": "Quick-Backend-Anlage fehlgeschlagen",
|
||||
"httpToHttps": "HTTP→HTTPS",
|
||||
"hsts": "HSTS",
|
||||
"tlsCert": "TLS-Cert",
|
||||
"tlsCertValid": "gültig",
|
||||
"tlsCertExpiring": "noch {{days}}d",
|
||||
"tlsCertExpired": "abgelaufen",
|
||||
"tlsCertError": "Fehler",
|
||||
"tlsCertNone": "fehlt",
|
||||
"tlsCertNoneHint": "Kein eigener TLS-Cert für diese Domain — HAProxy serviert das Bootstrap-Self-Signed-Cert. Im SSL-Tab issuen.",
|
||||
"hstsMaxAge": "HSTS max-age (Sek.)",
|
||||
"hstsMaxAgeHint": "Wie lange Browser den HTTPS-Zwang cachen. Empfehlung 31536000 (1 Jahr).",
|
||||
"hstsSubdomains": "includeSubDomains",
|
||||
"hstsSubdomainsHint": "Erstreckt HSTS auf alle Sub-Domains. Nur aktivieren wenn alle Subs ausschließlich HTTPS sprechen.",
|
||||
"hstsPreload": "preload",
|
||||
"hstsPreloadHint": "Setzt den preload-Flag damit die Domain in die hstspreload.org-Liste aufgenommen werden kann. Voraussetzung: max-age ≥ 31536000 + includeSubDomains an.",
|
||||
"maintenance": "Wartungs-Modus",
|
||||
"maintenanceHint": "An: alle Requests auf diese Domain bekommen direkt 503 von HAProxy. Backends werden nicht kontaktiert.",
|
||||
"maintenanceMessage": "Wartungs-Meldung",
|
||||
"maintenanceMessagePlaceholder": "Service vorübergehend nicht verfügbar.",
|
||||
"wwwRedirect": "www-Redirect",
|
||||
"wwwRedirectHint": "Kanonisiert die Domain. „nach naked\": Name=example.com → www.example.com leitet auf example.com. „nach www\": Name=www.example.com → example.com leitet auf www.example.com.",
|
||||
"wwwRedirectNone": "Kein Redirect",
|
||||
"wwwRedirectToNaked": "→ naked (ohne www)",
|
||||
"wwwRedirectToWWW": "→ www",
|
||||
"rateLimit": "Rate-Limit (pro Client-IP)",
|
||||
"rateLimitHint": "Max. Requests pro Sekunde je Client-IP. HAProxy zählt über ein 10-Sekunden-Fenster pro Stick-Table (max. 100k IPs). 0 = aus.",
|
||||
"maxBody": "Max. Request-Body",
|
||||
"maxBodyHint": "Cap auf Content-Length-Header. Größere Requests bekommen 413. Nicht erkannt: Chunked-Bodies (HAProxy bufferd nicht standardmäßig). 0 = aus.",
|
||||
"headersBtn": "Headers",
|
||||
"headersTitle": "Response-Headers — {{name}}",
|
||||
"headersHint": "Diese Header werden von HAProxy auf jede Response für diese Domain gesetzt (http-response set-header). Reihenfolge via Position.",
|
||||
"headersEmpty": "Noch keine Custom-Headers konfiguriert.",
|
||||
"addHeader": "Header hinzufügen",
|
||||
"editHeader": "Header bearbeiten",
|
||||
"headerName": "Name",
|
||||
"headerNameHint": "Nur Buchstaben, Zahlen, Bindestriche. Pro Domain case-insensitive eindeutig.",
|
||||
"headerNamePattern": "Nur a-z, A-Z, 0-9, '-'",
|
||||
"headerValue": "Wert",
|
||||
"headerPosition": "Position",
|
||||
"headerDeleteConfirm": "Header „{{name}}\" wirklich löschen?",
|
||||
"settingsSection": "HAProxy-Einstellungen",
|
||||
"notes": "Notizen",
|
||||
"actions": "Aktionen",
|
||||
"edit": "Bearbeiten",
|
||||
@@ -229,11 +306,14 @@
|
||||
"title": "Backends",
|
||||
"intro": "Upstream-Pools (Backend = N Server). HAProxy verteilt laut LB-Algorithmus; Health-Check-Pfad aktiviert HTTP-Probes alle 5s pro Server.",
|
||||
"addBackend": "Backend-Pool hinzufügen",
|
||||
"emptyTitle": "Noch keine Backend-Pools.",
|
||||
"emptyDesc": "Lege deinen ersten Pool an — definiere Upstream-Server (z. B. App-Server / Mailbox-Knoten) damit Domains darauf routen können.",
|
||||
"editBackend": "Backend-Pool bearbeiten",
|
||||
"name": "Name",
|
||||
"scheme": "Schema",
|
||||
"target": "Ziel",
|
||||
"healthCheck": "Health-Check-Pfad",
|
||||
"liveStatus": "HAProxy-Status",
|
||||
"active": "Aktiv",
|
||||
"usedBy": "Genutzt von",
|
||||
"noDomain": "keine Domain",
|
||||
@@ -271,6 +351,8 @@
|
||||
"title": "Routing-Regeln",
|
||||
"intro": "Pfad-Präfix → Backend-Mapping pro Domain. Niedrige Priority gewinnt; Catch-all per Domain.primary_backend.",
|
||||
"addRule": "Regel hinzufügen",
|
||||
"emptyTitle": "Noch keine Routing-Regeln.",
|
||||
"emptyDesc": "Pfad-spezifisches Routing — z. B. domain.tld/api → Backend A, domain.tld/* → Backend B. Optional. Ohne Regeln nutzt HAProxy die Primary-Backend-Auswahl der Domain.",
|
||||
"editRule": "Regel bearbeiten",
|
||||
"domain": "Domain",
|
||||
"pathPrefix": "Pfad-Präfix",
|
||||
@@ -313,8 +395,35 @@
|
||||
"configHash": "Config-Hash",
|
||||
"version": "Version",
|
||||
"lastSeen": "Last seen",
|
||||
"mgmtIp": "MGMT-IP"
|
||||
}
|
||||
"mgmtIp": "MGMT-IP",
|
||||
"load": "Load 1/5/15",
|
||||
"mem": "Memory",
|
||||
"disk": "Disk",
|
||||
"conntrack": "Conntrack",
|
||||
"uptime": "Uptime",
|
||||
"fetchMs": "Fetch"
|
||||
},
|
||||
"loadTitle": "Per-Node Resources (mTLS-Aggregator)",
|
||||
"loadEmpty": "Keine Node-Resources verfügbar — Agent-Listener nicht erreichbar?",
|
||||
"certCardTitle": "Cluster-TLS-Zertifikate",
|
||||
"certCALabel": "Cluster-CA",
|
||||
"certPeerLabel": "Peer-Cert (diese Node)",
|
||||
"certExpiry": "Läuft ab in",
|
||||
"renewSelfBtn": "Peer-Cert erneuern",
|
||||
"renewSelfConfirm": "Peer-Cert mit lokaler CA neu signieren (1 Jahr)? edgeguard-api Restart danach erforderlich.",
|
||||
"certRenewedRestartHint": "Cert erneuert — bitte sudo systemctl restart edgeguard-api ausführen.",
|
||||
"certRenewFailed": "Cert-Erneuerung fehlgeschlagen",
|
||||
"removePeerBtn": "Entfernen",
|
||||
"removePeerConfirmTitle": "Peer wirklich aus dem Cluster entfernen?",
|
||||
"removePeerConfirmDesc": "{{fqdn}} wird aus ha_nodes gelöscht. Firewall-Renderer entfernt seine IP aus dem peer_ipv4-Set. Auf der Peer-Seite läuft edgeguard-api weiter; manuell stoppen + cluster-tls löschen für vollständigen Decommission.",
|
||||
"removePeerOk": "Peer entfernt.",
|
||||
"removePeerFailed": "Peer-Entfernung fehlgeschlagen",
|
||||
"generateJoinToken": "Join-Token erzeugen",
|
||||
"joinTokenTitle": "Cluster-Join-Token",
|
||||
"joinTokenOneShot": "Einmalig anzeigen, einmalig nutzbar",
|
||||
"joinTokenOneShotDesc": "Token jetzt sicher übertragen — er erscheint nie wieder. Gültig bis {{expires}}. Beim Einlösen via cluster-join wird er server-seitig als verbraucht markiert.",
|
||||
"joinTokenFailed": "Token-Generierung fehlgeschlagen",
|
||||
"joinCmdLabel": "Auf dem neuen Node ausführen:"
|
||||
},
|
||||
"ssl": {
|
||||
"title": "SSL-Zertifikate",
|
||||
@@ -338,22 +447,112 @@
|
||||
"uploadButton": "Hochladen",
|
||||
"issueSuccess": "Zertifikat ausgestellt + installiert.",
|
||||
"uploadSuccess": "Zertifikat hochgeladen + installiert.",
|
||||
"renewBtn": "Renew",
|
||||
"renewConfirmTitle": "Zertifikat jetzt erneuern?",
|
||||
"renewConfirmDesc": "Triggert eine ACME-HTTP-01-Challenge für {{domain}}. Let's Encrypt hat Rate-Limits (50 Issues/Domain/Woche) — nicht öfter als nötig nutzen.",
|
||||
"renewSuccess": "Zertifikat erneuert + installiert.",
|
||||
"renewFailed": "Renewal fehlgeschlagen",
|
||||
"deleteConfirm": "Zertifikat für {{domain}} löschen? HAProxy fällt für diese Domain auf das Default-Cert zurück.",
|
||||
"installedTitle": "Installierte Zertifikate",
|
||||
"lastRenewed": "Zuletzt erneuert",
|
||||
"statTotal": "Zertifikate gesamt",
|
||||
"statExpiring": "< 30 Tage gültig",
|
||||
"statExpired": "Abgelaufen",
|
||||
"statErrors": "Mit Fehler",
|
||||
"relAgo": {
|
||||
"justNow": "gerade eben",
|
||||
"minutes": "vor {{n}} min",
|
||||
"hours": "vor {{n}} h",
|
||||
"days": "vor {{n}} Tagen"
|
||||
},
|
||||
"emptyTitle": "Noch keine Zertifikate installiert.",
|
||||
"emptyDesc": "Nutze die Tabs oben — Let's Encrypt issued vollautomatisch per HTTP-01-Challenge, oder lade ein eigenes PEM hoch. Bis dahin liefert HAProxy das Bootstrap-Self-Signed-Cert für alle Domains.",
|
||||
"certPem": "Zertifikat (PEM)",
|
||||
"chainPem": "Chain (PEM, optional)",
|
||||
"keyPem": "Private Key (PEM)"
|
||||
},
|
||||
"settings": {
|
||||
"title": "Einstellungen",
|
||||
"intro": "System-Information und Setup-Status. Bearbeitbare Werte folgen in einem späteren Release.",
|
||||
"intro": "System-Information, Setup-Status und Admin-Account.",
|
||||
"systemInfo": "System",
|
||||
"version": "Version",
|
||||
"status": "Status",
|
||||
"dbSize": "PostgreSQL-DB-Größe",
|
||||
"dbSizeTop": "Top-Tabellen",
|
||||
"upgradeStatusCardTitle": "Letzter Update-Versuch",
|
||||
"upgradeStatusStarted": "Gestartet",
|
||||
"upgradeStatusFinished": "Beendet",
|
||||
"upgradeStatusResult": "Ergebnis",
|
||||
"upgradeStatusState": "Status",
|
||||
"upgradeStatusOk": "Erfolgreich",
|
||||
"upgradeStatusShowLog": "Vollständiges Log anzeigen ({{n}} Zeilen)",
|
||||
"actionsCardTitle": "System-Aktionen",
|
||||
"actionsHint": "Manuelle Trigger für Operator-Tasks die sonst nur automatisch beim Speichern in den jeweiligen Seiten passieren. Sinnvoll nach SSH-Eingriffen (z. B. /etc/edgeguard/tls/ manuell befüllt).",
|
||||
"haproxyReloadBtn": "HAProxy reload",
|
||||
"haproxyReloadOk": "HAProxy neu geladen.",
|
||||
"haproxyReloadFailed": "HAProxy-Reload fehlgeschlagen",
|
||||
"renderConfigsBtn": "Configs neu rendern (HAProxy)",
|
||||
"renderConfigsOk": "Configs neu gerendert + reloaded.",
|
||||
"renderConfigsFailed": "Config-Render fehlgeschlagen",
|
||||
"backupNowBtn": "Backup jetzt erstellen",
|
||||
"backupNowOk": "Backup ausgelöst — Status in der Backups-Seite verfolgen.",
|
||||
"backupNowFailed": "Backup-Trigger fehlgeschlagen",
|
||||
"serviceRestartCardTitle": "Dienste neu starten",
|
||||
"serviceRestartBtn": "Restart",
|
||||
"serviceRestartOk": "{{service}} wurde neu gestartet.",
|
||||
"serviceRestartFailed": "Neustart von {{service}} fehlgeschlagen",
|
||||
"serviceRestartHint": "Startet den Dienst via systemctl restart. edgeguard-api und PostgreSQL sind bewusst ausgeschlossen.",
|
||||
"setupInfo": "Setup",
|
||||
"adminEmail": "Admin-E-Mail",
|
||||
"fqdn": "FQDN",
|
||||
"setupCompleted": "Setup abgeschlossen"
|
||||
"setupCompleted": "Setup abgeschlossen",
|
||||
"emailsCardTitle": "Kontakt-E-Mails",
|
||||
"adminEmailHint": "Wird beim Login als Admin-Identifier genutzt. Änderung erfordert Re-Login mit der neuen Adresse.",
|
||||
"acmeEmail": "ACME-E-Mail",
|
||||
"acmeEmailHint": "Wird Let's Encrypt als Account-Contact mitgegeben. Bestehende Zertifikate sind nicht betroffen — die nächste Renew-Operation registriert die neue Adresse.",
|
||||
"emailsSaved": "E-Mails aktualisiert.",
|
||||
"emailsFailed": "E-Mail-Update fehlgeschlagen",
|
||||
"maintenanceCardTitle": "Wartungs-Modus (gesamte Box)",
|
||||
"maintenanceOn": "Aktiv — alle Customer-Domains liefern 503. Mgmt-UI bleibt erreichbar.",
|
||||
"maintenanceOff": "Inaktiv — Customer-Traffic wird normal an die Backends geroutet.",
|
||||
"maintenanceMessage": "Wartungs-Meldung",
|
||||
"maintenanceMessagePlaceholder": "Service vorübergehend nicht verfügbar — wir sind in Kürze zurück.",
|
||||
"maintenanceMessageHint": "Wird im Response-Body der 503-Antworten an Endkunden mitgeschickt. Plain text, max. 500 Zeichen.",
|
||||
"maintenanceHint": "Schaltet HAProxy auf :443 in einen Default-503-Modus. Pro-Domain-Maintenance (Domains-Seite) wird hiervon übersteuert. Mgmt-UI auf :3443 ist NICHT betroffen.",
|
||||
"maintenanceSaved": "Wartungs-Modus aktualisiert.",
|
||||
"maintenanceFailed": "Wartungs-Modus-Toggle fehlgeschlagen",
|
||||
"maintenanceActiveTitle": "Wartungs-Modus aktiv",
|
||||
"maintenanceActiveDesc": "Alle Customer-Domains liefern aktuell 503. Mgmt-UI ist erreichbar — Customer-Traffic NICHT. Settings → Wartungs-Modus zum Deaktivieren.",
|
||||
"backupRetentionCardTitle": "Backup-Aufbewahrung",
|
||||
"backupRetentionUnit": "Backups",
|
||||
"backupRetentionDefault": "Default ({{n}} Backups) — pro Tag bei täglichem Schedule = {{n}} Tage History.",
|
||||
"backupRetentionCustom": "Custom — die letzten {{n}} erfolgreichen Backups werden behalten, ältere werden nach jedem Backup-Lauf gelöscht.",
|
||||
"backupRetentionHint": "0 = Default (14). 1-365 = Custom-Limit. Bedenke: jedes Backup ist ein voller pg_dump + Files-tar (typisch 50-500 MB). Bei /var-Disk-Druck eher reduzieren.",
|
||||
"backupRetentionSaved": "Backup-Retention aktualisiert.",
|
||||
"backupRetentionFailed": "Backup-Retention-Update fehlgeschlagen",
|
||||
"auditRetentionCardTitle": "Audit-Log-Aufbewahrung",
|
||||
"auditRetentionUnit": "Tage",
|
||||
"auditRetentionDefault": "Default ({{n}} Tage) — Audit-Einträge älter als {{n}} Tage werden täglich gepruned.",
|
||||
"auditRetentionCustom": "Custom — Audit-Einträge werden für {{n}} Tage behalten.",
|
||||
"auditRetentionHint": "0 = Default (90). 1-3650 (= 10 Jahre) für Compliance (SOX 7y = 2555, DSGVO meist <= 365). Cleanup läuft im Scheduler täglich.",
|
||||
"auditRetentionSaved": "Audit-Retention aktualisiert.",
|
||||
"auditRetentionFailed": "Audit-Retention-Update fehlgeschlagen",
|
||||
"autoUpdateCardTitle": "Automatische Updates",
|
||||
"autoUpdateOn": "Aktiviert — edgeguard-Pakete werden täglich automatisch installiert.",
|
||||
"autoUpdateOff": "Deaktiviert — Updates müssen manuell über den Banner installiert werden.",
|
||||
"autoUpdateHint": "Whitelist umfasst nur edgeguard, edgeguard-api, edgeguard-ui. Andere Pakete bleiben unter manueller Kontrolle. Verlangt unattended-upgrades (Distro-Standard auf Trixie). Conf-File: /etc/apt/apt.conf.d/52edgeguard-auto-updates.",
|
||||
"autoUpdateToggled": "Auto-Update-Einstellung gespeichert.",
|
||||
"autoUpdateFailed": "Auto-Update-Toggle fehlgeschlagen",
|
||||
"passwordCardTitle": "Admin-Passwort ändern",
|
||||
"currentPassword": "Aktuelles Passwort",
|
||||
"newPassword": "Neues Passwort",
|
||||
"newPasswordHint": "Mindestens 12 Zeichen. Wird mit bcrypt gehasht.",
|
||||
"confirmPassword": "Neues Passwort bestätigen",
|
||||
"changePasswordBtn": "Passwort ändern",
|
||||
"passwordChanged": "Passwort geändert.",
|
||||
"passwordChangeFailed": "Passwort-Änderung fehlgeschlagen",
|
||||
"passwordMismatch": "Die Passwörter stimmen nicht überein.",
|
||||
"passwordMinLen": "Mindestens 12 Zeichen erforderlich."
|
||||
},
|
||||
"update": {
|
||||
"available": "Update verfügbar: Version {{version}}",
|
||||
@@ -362,6 +561,8 @@
|
||||
"confirmTitle": "Update jetzt installieren?",
|
||||
"confirmDesc": "Pakete werden auf Version {{version}} aktualisiert. edgeguard-api + scheduler restarten (~2-5s), HAProxy/nft/WG/Squid/Unbound/Chrony laufen durch.",
|
||||
"checkNow": "Auf Updates prüfen",
|
||||
"checkNowHint": "Server-seitigen apt-Cache jetzt aktualisieren und nach neueren Versionen schauen.",
|
||||
"updateReady": "Update bereit: v{{version}}",
|
||||
"checkDone": "Update verfügbar",
|
||||
"noUpdate": "Keine neuen Updates",
|
||||
"checkFailed": "Update-Check fehlgeschlagen",
|
||||
@@ -404,6 +605,10 @@
|
||||
"editServer": "Server-Tunnel bearbeiten",
|
||||
"addClient": "Client-Tunnel hinzufügen",
|
||||
"editClient": "Client-Tunnel bearbeiten",
|
||||
"emptyServerTitle": "Noch keine WireGuard-Server-Tunnel.",
|
||||
"emptyServerDesc": "Server-Modus: diese Box hört auf einem UDP-Port und akzeptiert Peer-Verbindungen (z. B. Roadwarrior-User, Site-to-Site-Niederlassungen).",
|
||||
"emptyClientTitle": "Noch keine WireGuard-Client-Tunnel.",
|
||||
"emptyClientDesc": "Client-Modus: diese Box verbindet sich zu einem externen WireGuard-Server (z. B. HQ-Datacenter, Cloud-Anbindung).",
|
||||
"upstream": "Upstream-Peer",
|
||||
"deleteConfirm": "Tunnel {{name}} wirklich löschen? wg-quick wird gestoppt.",
|
||||
"keys": "Schlüssel",
|
||||
@@ -430,6 +635,8 @@
|
||||
"add": "Peer hinzufügen",
|
||||
"edit": "Peer bearbeiten",
|
||||
"deleteConfirm": "Peer {{name}} wirklich entfernen?",
|
||||
"emptyTitle": "Noch keine Peers in diesem Tunnel.",
|
||||
"emptyDesc": "Lege Peers an — pro Peer eine WireGuard-Identität (Public-Key + Allowed-IPs). Server-generierte Keys liefern dir Config-Download bzw. QR-Code für Mobile-Clients direkt mit.",
|
||||
"keys": "Schlüssel",
|
||||
"generateExtra": "Wenn an: Server erzeugt für diesen Peer ein Keypair und kann die Config / QR-Code ausliefern. Wenn aus: nur den Public-Key paste-en — keine Config-Download möglich.",
|
||||
"pskExtra": "Wenn an: Server generiert einen 32-Byte PSK für diesen Peer.",
|
||||
@@ -471,7 +678,15 @@
|
||||
},
|
||||
"clusterCard": {
|
||||
"title": "Cluster",
|
||||
"nodes": "Knoten"
|
||||
"nodes": "Knoten",
|
||||
"modeSingle": "Single-Node",
|
||||
"modeCluster": "Cluster",
|
||||
"drift": "Config-Drift erkannt",
|
||||
"health": {
|
||||
"ok": "OK",
|
||||
"degraded": "degraded",
|
||||
"split-brain": "split-brain"
|
||||
}
|
||||
},
|
||||
"routingCard": {
|
||||
"title": "Routing",
|
||||
@@ -486,6 +701,15 @@
|
||||
"ifaces": "Interfaces",
|
||||
"wg": "WireGuard"
|
||||
},
|
||||
"alertsCard": {
|
||||
"title": "Aktuelle Alerts",
|
||||
"viewAll": "Alle anzeigen"
|
||||
},
|
||||
"onboardingTitle": "Willkommen bei EdgeGuard",
|
||||
"onboardingIntro": "Frische Box — hier die nächsten Schritte um Customer-Traffic zu routen:",
|
||||
"onboardingStep1": "Backend-Pool anlegen (App-Server hinter HAProxy)",
|
||||
"onboardingStep2": "Domain hinzufügen (FQDN, primary Backend zuweisen)",
|
||||
"onboardingStep3": "TLS-Zertifikat ausstellen (Let's Encrypt HTTP-01)",
|
||||
"servicesCard": {
|
||||
"title": "Service-Status (live, 10s)"
|
||||
},
|
||||
@@ -510,6 +734,17 @@
|
||||
"title": "Zeitserver (Chrony)",
|
||||
"intro": "Chrony als Time-Sync-Daemon (NTP). Quellen oben, Listen-/Serve-Konfig im Settings-Tab. Wenn 'serve_clients' aktiv und LAN-IPs gebound sind, wird die Box selbst zum NTP-Server für das LAN.",
|
||||
"tabs": { "pools": "Quellen", "settings": "Settings" },
|
||||
"statusCard": {
|
||||
"title": "Sync-Status (chronyc tracking)",
|
||||
"sync": "Synchronisiert",
|
||||
"synced": "Ja",
|
||||
"notSynced": "Nein",
|
||||
"source": "Quelle",
|
||||
"stratum": "Stratum",
|
||||
"offset": "Offset",
|
||||
"offsetHint": "Zeitdifferenz zur Referenzquelle. Werte > 100 ms sind ungewöhnlich — Netzwerkprobleme oder fehlkonfigurierte Quelle prüfen.",
|
||||
"loading": "Lade…"
|
||||
},
|
||||
"pool": {
|
||||
"kind": "Typ",
|
||||
"kindPool": "pool — DNS-Round-Robin (mehrere Server aus A-Records)",
|
||||
@@ -524,7 +759,9 @@
|
||||
"description": "Beschreibung",
|
||||
"add": "Quelle hinzufügen",
|
||||
"edit": "Quelle bearbeiten",
|
||||
"deleteConfirm": "NTP-Quelle {{addr}} wirklich löschen?"
|
||||
"deleteConfirm": "NTP-Quelle {{addr}} wirklich löschen?",
|
||||
"emptyTitle": "Noch keine NTP-Quellen.",
|
||||
"emptyDesc": "Ohne konfigurierte Pool/Server-Einträge nutzt chrony nur seine compiled-in Default-Pool (debian.pool.ntp.org). Setze eigene Pools für genauere Zeitabstimmung oder interne Stratum-Server."
|
||||
},
|
||||
"settings": {
|
||||
"intro": "Globale Chrony-Settings. Save reloaded chrony automatisch.",
|
||||
@@ -560,7 +797,9 @@
|
||||
"records": "Records …",
|
||||
"add": "Zone hinzufügen",
|
||||
"edit": "Zone bearbeiten",
|
||||
"deleteConfirm": "Zone {{name}} mit allen Records wirklich löschen?"
|
||||
"deleteConfirm": "Zone {{name}} mit allen Records wirklich löschen?",
|
||||
"emptyTitle": "Noch keine DNS-Zonen.",
|
||||
"emptyDesc": "Unbound forwarded standardmäßig alles an die Upstream-Resolver. Lege eine Zone an, um z. B. interne FQDNs (internal.example.com) lokal zu hosten oder einen Upstream-Stub für eine fremde Domain einzurichten."
|
||||
},
|
||||
"record": {
|
||||
"name": "Name",
|
||||
@@ -572,7 +811,9 @@
|
||||
"drawerTitle": "DNS-Records",
|
||||
"add": "Record hinzufügen",
|
||||
"edit": "Record bearbeiten",
|
||||
"deleteConfirm": "Record {{name}} wirklich löschen?"
|
||||
"deleteConfirm": "Record {{name}} wirklich löschen?",
|
||||
"emptyTitle": "Noch keine Records in dieser Zone.",
|
||||
"emptyDesc": "A/AAAA/CNAME/MX/TXT-Einträge. Bei local-Zone authoritativ; bei forward-Zone hat das hier keinen Effekt (Upstream gewinnt)."
|
||||
},
|
||||
"settings": {
|
||||
"intro": "Globale Resolver-Settings. Änderungen hier reloaden Unbound automatisch.",
|
||||
@@ -608,7 +849,9 @@
|
||||
"comment": "Kommentar",
|
||||
"add": "ACL hinzufügen",
|
||||
"edit": "ACL bearbeiten",
|
||||
"deleteConfirm": "ACL {{name}} wirklich löschen?"
|
||||
"deleteConfirm": "ACL {{name}} wirklich löschen?",
|
||||
"emptyTitle": "Noch keine Forward-Proxy-ACLs.",
|
||||
"emptyDesc": "Default ohne ACLs: nur localnet (10/8, 172.16/12, 192.168/16) darf raus. Lege eine ACL an, um spezifische Domains/IPs/Ports gezielt zu erlauben oder zu blocken."
|
||||
},
|
||||
"common": {
|
||||
"yes": "Ja",
|
||||
@@ -629,7 +872,9 @@
|
||||
"add": "Hinzufügen",
|
||||
"download": "Download",
|
||||
"copy": "Kopieren",
|
||||
"copied": "Kopiert"
|
||||
"copied": "Kopiert",
|
||||
"close": "Schließen",
|
||||
"refresh": "Aktualisieren"
|
||||
},
|
||||
"license": {
|
||||
"title": "Lizenz",
|
||||
@@ -678,6 +923,8 @@
|
||||
"addTitle": "Statische Route anlegen",
|
||||
"editTitle": "Statische Route bearbeiten",
|
||||
"empty": "Keine verwalteten Routen.",
|
||||
"emptyTitle": "Noch keine verwalteten Routen.",
|
||||
"emptyDesc": "Statische Routen die EdgeGuard beim Boot setzt (z. B. nach 10.0.5.0/24 via VPN-Gateway). Live-Routen oben sind read-only — was hier eingetragen wird, persistiert.",
|
||||
"confirmDelete": "Route nach {{dest}} wirklich löschen?",
|
||||
"refreshTooltip": "Live-Routen neu laden",
|
||||
"destExtra": "CIDR — z.B. 10.0.5.0/24 oder 0.0.0.0/0 für Default-Route.",
|
||||
@@ -711,6 +958,10 @@
|
||||
"testDone": "Test gesendet — {{ok}}/{{total}} Channels erfolgreich",
|
||||
"emptyChannels": "Keine Channels. Lege einen Webhook oder eine Email an.",
|
||||
"emptyEvents": "Noch keine Alarme — Triggers haben noch keinen Event gefeuert.",
|
||||
"emptyChannelsTitle": "Noch keine Alert-Channels.",
|
||||
"emptyChannelsDesc": "Ohne Channels werden gefeuerte Events nur in die Datenbank (Tab \"Events\") geschrieben — niemand wird benachrichtigt. Lege einen Webhook (Mattermost/Slack/Discord/Custom) oder eine SMTP-Email an.",
|
||||
"emptyEventsTitle": "Noch keine Alert-Events.",
|
||||
"emptyEventsDesc": "Triggers (Cert-Expiry, Backup-Fail, Cluster-Drift, License-Invalid, etc.) haben noch keinen Event gefeuert. Wenn sie feuern, landen sie hier und werden an die konfigurierten Channels zugestellt.",
|
||||
"noChannels": "kein Channel aktiv",
|
||||
"confirmDelete": "Channel {{name}} wirklich löschen?",
|
||||
"col": {
|
||||
@@ -766,6 +1017,12 @@
|
||||
"scopeTitle": "Was wird gesichert?",
|
||||
"scopeDesc": "DB-Dump (pg_dump --clean), setup.json, license_key, license.cache, .jwt_fingerprint, acme-account/. Konfig-Dateien (haproxy.cfg, nft, …) sind aus der DB regenerierbar und werden NICHT mitgesichert.",
|
||||
"tabs": { "history": "Sicherungen", "remotes": "Off-Site-Ziele" },
|
||||
"statLastSuccess": "Letzte erfolgreiche Sicherung",
|
||||
"statTotal": "Erfolgreiche Sicherungen",
|
||||
"statSize": "Gesamtgröße",
|
||||
"statFails24h": "Fehlschläge (24 h)",
|
||||
"statHoursAgo": "vor {{n}} h",
|
||||
"statDaysAgo": "vor {{n}} Tagen",
|
||||
"runNow": "Backup jetzt erstellen",
|
||||
"created": "Backup erstellt: {{file}}",
|
||||
"failed": "Backup fehlgeschlagen",
|
||||
@@ -821,7 +1078,8 @@
|
||||
"filter": {
|
||||
"sources": "Quellen wählen (alle wenn leer)",
|
||||
"levels": "Level filtern",
|
||||
"grep": "Volltext-Suche"
|
||||
"grep": "Volltext-Suche",
|
||||
"reset": "Filter zurücksetzen"
|
||||
}
|
||||
},
|
||||
"fwlog": {
|
||||
@@ -861,5 +1119,34 @@
|
||||
"dst": "Ziel-IP",
|
||||
"rule": "Rule-ID"
|
||||
}
|
||||
},
|
||||
"audit": {
|
||||
"title": "Audit-Log",
|
||||
"intro": "Wer hat was wann geändert. Jede Mutation in der API (Domain anlegen, Backend deaktivieren, Cert ausstellen, …) ist hier nachvollziehbar.",
|
||||
"filter": {
|
||||
"actor": "Actor",
|
||||
"action": "Aktion",
|
||||
"subject": "Subjekt",
|
||||
"range": "Zeitraum",
|
||||
"search": "Suchen",
|
||||
"reset": "Zurücksetzen"
|
||||
},
|
||||
"col": {
|
||||
"time": "Zeit",
|
||||
"actor": "Actor",
|
||||
"action": "Aktion",
|
||||
"subject": "Subjekt",
|
||||
"detail": "Details"
|
||||
},
|
||||
"detailShow": "Details anzeigen",
|
||||
"empty": {
|
||||
"title": "Keine Treffer",
|
||||
"desc": "Mit diesen Filtern wurden keine Einträge gefunden. Filter ändern oder zurücksetzen."
|
||||
},
|
||||
"page": {
|
||||
"prev": "Zurück",
|
||||
"next": "Weiter",
|
||||
"showing": "Zeile {{from}}–{{to}}"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -20,6 +20,7 @@
|
||||
"firewallLive": "Firewall log",
|
||||
"cluster": "Cluster",
|
||||
"logs": "Logs",
|
||||
"audit": "Audit log",
|
||||
"backups": "Backups",
|
||||
"diagnostics": "Diagnostics",
|
||||
"alerts": "Alerts",
|
||||
@@ -44,7 +45,8 @@
|
||||
"addrObj": "Address objects",
|
||||
"addrGrp": "Address groups",
|
||||
"services": "Services",
|
||||
"svcGrp": "Service groups"
|
||||
"svcGrp": "Service groups",
|
||||
"system": "System rules"
|
||||
},
|
||||
"zone": {
|
||||
"name": "Name",
|
||||
@@ -55,31 +57,41 @@
|
||||
"namePattern": "Lowercase letters, digits, _ and -; must start with a letter, up to 32 chars.",
|
||||
"add": "Add zone",
|
||||
"edit": "Edit zone",
|
||||
"deleteConfirm": "Really delete zone {{name}}?"
|
||||
"deleteConfirm": "Really delete zone {{name}}?",
|
||||
"emptyTitle": "No custom firewall zones yet.",
|
||||
"emptyDesc": "Zones group interfaces (lan, wan, dmz). Built-in zones already exist; add custom ones for e.g. a separate dmz or a wg zone for VPN."
|
||||
},
|
||||
"ao": {
|
||||
"name": "Name", "kind": "Kind", "value": "Value", "description": "Description",
|
||||
"add": "Add address object", "edit": "Edit address object",
|
||||
"deleteConfirm": "Really delete address object {{name}}?"
|
||||
"deleteConfirm": "Really delete address object {{name}}?",
|
||||
"emptyTitle": "No address objects yet.",
|
||||
"emptyDesc": "Reusable named IPs/networks/ranges for firewall + NAT rules (e.g. office-net = 10.0.0.0/24, mailbox-1 = 10.0.1.42)."
|
||||
},
|
||||
"ag": {
|
||||
"name": "Name", "members": "Members", "description": "Description",
|
||||
"add": "Add address group", "edit": "Edit address group",
|
||||
"selectMembers": "Select address objects",
|
||||
"deleteConfirm": "Really delete address group {{name}}?"
|
||||
"deleteConfirm": "Really delete address group {{name}}?",
|
||||
"emptyTitle": "No address groups yet.",
|
||||
"emptyDesc": "Bundle multiple address objects into a group (e.g. office-locations = [hq-net, branch-1-net, branch-2-net]) — rules then reference one group."
|
||||
},
|
||||
"svc": {
|
||||
"name": "Name", "proto": "Protocol", "ports": "Ports",
|
||||
"portStart": "Port (start)", "portEnd": "Port (end)",
|
||||
"description": "Description", "builtinHint": "Built-in — not editable",
|
||||
"add": "Add service", "edit": "Edit service",
|
||||
"deleteConfirm": "Really delete service {{name}}?"
|
||||
"deleteConfirm": "Really delete service {{name}}?",
|
||||
"emptyTitle": "No custom services yet.",
|
||||
"emptyDesc": "Built-ins (HTTP, HTTPS, SSH, …) already exist. Add app-specific ports (e.g. mailcow-imaps tcp/993) to make rules easier to read."
|
||||
},
|
||||
"sg": {
|
||||
"name": "Name", "members": "Members", "description": "Description",
|
||||
"add": "Add service group", "edit": "Edit service group",
|
||||
"selectMembers": "Select services",
|
||||
"deleteConfirm": "Really delete service group {{name}}?"
|
||||
"deleteConfirm": "Really delete service group {{name}}?",
|
||||
"emptyTitle": "No service groups yet.",
|
||||
"emptyDesc": "Bundle multiple services into a group (e.g. web-stack = [HTTP, HTTPS, HTTP/3]) — one rule with the group replaces three rules per service."
|
||||
},
|
||||
"rule": {
|
||||
"name": "Name", "priority": "Priority", "enabled": "Enabled", "log": "Log",
|
||||
@@ -90,7 +102,9 @@
|
||||
"serviceKind": "Service kind", "serviceGroup": "Service group",
|
||||
"comment": "Comment",
|
||||
"add": "Add rule", "edit": "Edit rule",
|
||||
"deleteConfirm": "Really delete this rule?"
|
||||
"deleteConfirm": "Really delete this rule?",
|
||||
"emptyTitle": "No custom firewall rules yet.",
|
||||
"emptyDesc": "The system rules above keep SSH (rate-limited), HTTPS :443 and the mgmt UI :3443 open (anti-lockout). Add custom rules for app-specific inbound ports or cross-zone forwards."
|
||||
},
|
||||
"nat": {
|
||||
"name": "Name", "priority": "Priority", "kind": "Kind", "enabled": "Enabled",
|
||||
@@ -102,7 +116,9 @@
|
||||
"targetAddr": "Target address", "targetPortStart": "Target port (start)", "targetPortEnd": "Target port (end)",
|
||||
"comment": "Comment",
|
||||
"add": "Add NAT rule", "edit": "Edit NAT rule",
|
||||
"deleteConfirm": "Really delete this NAT rule?"
|
||||
"deleteConfirm": "Really delete this NAT rule?",
|
||||
"emptyTitle": "No NAT rules yet.",
|
||||
"emptyDesc": "DNAT (e.g. external :2030 → internal 10.10.20.12:22 for SSH to an internal host) or SNAT/MASQUERADE (internet access for an internal subnet via the box IP)."
|
||||
},
|
||||
"sys": {
|
||||
"title": "System rules (always active)",
|
||||
@@ -125,6 +141,8 @@
|
||||
"systemDiscovered": "System interfaces (read-only)",
|
||||
"addInterface": "Add interface",
|
||||
"editInterface": "Edit interface",
|
||||
"emptyTitle": "No managed interfaces yet.",
|
||||
"emptyDesc": "System interfaces (above) are detected read-only. Managed interfaces are what EdgeGuard creates itself — VLANs, bridges, bonds, GRE tunnels — and renders into /etc/network/interfaces.d.",
|
||||
"name": "Name",
|
||||
"type": "Type",
|
||||
"parent": "Parent interface",
|
||||
@@ -152,6 +170,8 @@
|
||||
"managedTitle": "Managed addresses",
|
||||
"family": "Family",
|
||||
"addAddress": "Add address",
|
||||
"emptyTitle": "No managed IP addresses yet.",
|
||||
"emptyDesc": "Add your first IP — floating VIPs for HA failover or extra listen addresses for HAProxy/Squid/Unbound. Distro-owned IPs are shown above under \"Detected IPs\".",
|
||||
"editAddress": "Edit address",
|
||||
"interface": "Interface",
|
||||
"selectInterface": "Select interface",
|
||||
@@ -192,12 +212,19 @@
|
||||
"setup": {
|
||||
"title": "First-time setup",
|
||||
"intro": "Create the admin account, declare the public FQDN, and — optionally — paste a license key. Without one, a 30-day trial starts.",
|
||||
"preflightTitle": "Before you hit \"Finish setup\"",
|
||||
"preflightDesc": "The FQDN must already resolve to this box via DNS (A/AAAA record). Without DNS resolution the later ACME HTTP-01 challenge fails — your browser URL should already be this FQDN, otherwise things break at first Let's Encrypt issue.",
|
||||
"adminEmail": "Admin email",
|
||||
"adminEmailHint": "Login identifier for the management UI. NOT used for outbound mail (use the ACME email below or the SMTP settings inside the Alerts channel).",
|
||||
"adminPassword": "Admin password",
|
||||
"passwordRule": "At least 12 characters.",
|
||||
"fqdn": "Public FQDN",
|
||||
"fqdnHint": "Fully-qualified hostname of this box (e.g. eg.example.com). Becomes the Subject-CN of the self-signed bootstrap cert AND ends up in the ACME cert once Let's Encrypt has issued. Must resolve to the public IP via DNS.",
|
||||
"fqdnInvalid": "Doesn't look like a valid FQDN (at least label.tld).",
|
||||
"acmeEmail": "ACME / Let's Encrypt email",
|
||||
"acmeEmailHint": "Sent to Let's Encrypt as account contact (expiry warnings + LE compliance mail). Can be the same as the admin email, but doesn't have to be.",
|
||||
"licenseKey": "License key (optional)",
|
||||
"licenseKeyHint": "If present: 30-day trial is skipped, features unlock immediately. Can also be added later under License.",
|
||||
"submit": "Finish setup",
|
||||
"successTitle": "Setup complete",
|
||||
"successHint": "Redirecting you to sign-in."
|
||||
@@ -211,14 +238,64 @@
|
||||
"intro": "Manage FQDNs that HAProxy terminates. Optional primary backend as catch-all; path-based routing via routing rules.",
|
||||
"addDomain": "Add domain",
|
||||
"editDomain": "Edit domain",
|
||||
"emptyTitle": "No domains yet.",
|
||||
"emptyDesc": "Add your first domain — HAProxy will then terminate TLS for that hostname and route to the chosen backend.",
|
||||
"name": "Name",
|
||||
"active": "Active",
|
||||
"primaryBackend": "Primary backend",
|
||||
"primaryBackendHint": "Catch-all backend for requests with no matching routing rule. Optional — leave empty if all traffic is routed via routing rules.",
|
||||
"selectBackend": "Select backend",
|
||||
"noBackend": "no backend",
|
||||
"quickBackendBtn": "+ new",
|
||||
"quickBackendBtnHint": "Create backend + first upstream server in one click — skips the trip to the Backends page.",
|
||||
"quickBackendTitle": "Quick-add backend",
|
||||
"quickBackendName": "Backend name",
|
||||
"quickBackendScheme": "Scheme",
|
||||
"quickBackendAddress": "Server address (first upstream)",
|
||||
"quickBackendPort": "Port",
|
||||
"quickBackendCreated": "Backend + server created and selected.",
|
||||
"quickBackendFailed": "Quick-add backend failed",
|
||||
"httpToHttps": "HTTP→HTTPS",
|
||||
"hsts": "HSTS",
|
||||
"tlsCert": "TLS cert",
|
||||
"tlsCertValid": "valid",
|
||||
"tlsCertExpiring": "{{days}}d left",
|
||||
"tlsCertExpired": "expired",
|
||||
"tlsCertError": "error",
|
||||
"tlsCertNone": "missing",
|
||||
"tlsCertNoneHint": "No own TLS cert for this domain — HAProxy serves the bootstrap self-signed cert. Issue one in the SSL tab.",
|
||||
"hstsMaxAge": "HSTS max-age (sec)",
|
||||
"hstsMaxAgeHint": "How long browsers cache the HTTPS-only mandate. Recommended: 31536000 (1 year).",
|
||||
"hstsSubdomains": "includeSubDomains",
|
||||
"hstsSubdomainsHint": "Extends HSTS to all subdomains. Enable only if every subdomain speaks HTTPS exclusively.",
|
||||
"hstsPreload": "preload",
|
||||
"hstsPreloadHint": "Sets the preload flag so the domain may be added to hstspreload.org. Requires max-age ≥ 31536000 and includeSubDomains enabled.",
|
||||
"maintenance": "Maintenance mode",
|
||||
"maintenanceHint": "On: every request to this domain receives 503 directly from HAProxy. Backends are not contacted.",
|
||||
"maintenanceMessage": "Maintenance message",
|
||||
"maintenanceMessagePlaceholder": "Service temporarily unavailable.",
|
||||
"wwwRedirect": "www redirect",
|
||||
"wwwRedirectHint": "Canonicalises the domain. \"to naked\": Name=example.com → www.example.com redirects to example.com. \"to www\": Name=www.example.com → example.com redirects to www.example.com.",
|
||||
"wwwRedirectNone": "No redirect",
|
||||
"wwwRedirectToNaked": "→ naked (no www)",
|
||||
"wwwRedirectToWWW": "→ www",
|
||||
"rateLimit": "Rate limit (per client IP)",
|
||||
"rateLimitHint": "Max requests per second per client IP. HAProxy counts over a 10-second window per stick table (max. 100k IPs). 0 = off.",
|
||||
"maxBody": "Max request body",
|
||||
"maxBodyHint": "Cap on the Content-Length header. Larger requests get 413. Chunked bodies are not detected (HAProxy doesn't buffer by default). 0 = off.",
|
||||
"headersBtn": "Headers",
|
||||
"headersTitle": "Response headers — {{name}}",
|
||||
"headersHint": "These headers are set by HAProxy on every response for this domain (http-response set-header). Ordering via position.",
|
||||
"headersEmpty": "No custom headers configured yet.",
|
||||
"addHeader": "Add header",
|
||||
"editHeader": "Edit header",
|
||||
"headerName": "Name",
|
||||
"headerNameHint": "Letters, digits, hyphens only. Case-insensitive unique per domain.",
|
||||
"headerNamePattern": "Only a-z, A-Z, 0-9, '-'",
|
||||
"headerValue": "Value",
|
||||
"headerPosition": "Position",
|
||||
"headerDeleteConfirm": "Really delete header \"{{name}}\"?",
|
||||
"settingsSection": "HAProxy settings",
|
||||
"notes": "Notes",
|
||||
"actions": "Actions",
|
||||
"edit": "Edit",
|
||||
@@ -229,11 +306,14 @@
|
||||
"title": "Backends",
|
||||
"intro": "Upstream pools (one backend = N servers). HAProxy balances load by the chosen algorithm; health-check path enables HTTP probes every 5s per server.",
|
||||
"addBackend": "Add backend pool",
|
||||
"emptyTitle": "No backend pools yet.",
|
||||
"emptyDesc": "Add your first pool — define upstream servers (e.g. app servers / mailbox nodes) so domains can route to them.",
|
||||
"editBackend": "Edit backend pool",
|
||||
"name": "Name",
|
||||
"scheme": "Scheme",
|
||||
"target": "Target",
|
||||
"healthCheck": "Health check path",
|
||||
"liveStatus": "HAProxy status",
|
||||
"active": "Active",
|
||||
"usedBy": "Used by",
|
||||
"noDomain": "no domain",
|
||||
@@ -271,6 +351,8 @@
|
||||
"title": "Routing rules",
|
||||
"intro": "Path-prefix → backend mapping per domain. Lowest priority wins; catch-all via domain.primary_backend.",
|
||||
"addRule": "Add rule",
|
||||
"emptyTitle": "No routing rules yet.",
|
||||
"emptyDesc": "Path-specific routing — e.g. domain.tld/api → Backend A, domain.tld/* → Backend B. Optional. Without rules HAProxy uses the primary backend from the domain.",
|
||||
"editRule": "Edit rule",
|
||||
"domain": "Domain",
|
||||
"pathPrefix": "Path prefix",
|
||||
@@ -313,8 +395,35 @@
|
||||
"configHash": "Config hash",
|
||||
"version": "Version",
|
||||
"lastSeen": "Last seen",
|
||||
"mgmtIp": "MGMT IP"
|
||||
}
|
||||
"mgmtIp": "MGMT IP",
|
||||
"load": "Load 1/5/15",
|
||||
"mem": "Memory",
|
||||
"disk": "Disk",
|
||||
"conntrack": "Conntrack",
|
||||
"uptime": "Uptime",
|
||||
"fetchMs": "Fetch"
|
||||
},
|
||||
"loadTitle": "Per-node resources (mTLS aggregator)",
|
||||
"loadEmpty": "No node resources available — agent listener unreachable?",
|
||||
"certCardTitle": "Cluster TLS certificates",
|
||||
"certCALabel": "Cluster CA",
|
||||
"certPeerLabel": "Peer cert (this node)",
|
||||
"certExpiry": "Expires in",
|
||||
"renewSelfBtn": "Renew peer cert",
|
||||
"renewSelfConfirm": "Re-sign peer cert with the local CA (1 year)? edgeguard-api restart required after.",
|
||||
"certRenewedRestartHint": "Cert renewed — please run sudo systemctl restart edgeguard-api.",
|
||||
"certRenewFailed": "Cert renewal failed",
|
||||
"removePeerBtn": "Remove",
|
||||
"removePeerConfirmTitle": "Really remove peer from the cluster?",
|
||||
"removePeerConfirmDesc": "{{fqdn}} is deleted from ha_nodes. Firewall renderer drops its IP from the peer_ipv4 set. On the peer side edgeguard-api keeps running; manually stop it + delete cluster-tls for a full decommission.",
|
||||
"removePeerOk": "Peer removed.",
|
||||
"removePeerFailed": "Peer removal failed",
|
||||
"generateJoinToken": "Generate join token",
|
||||
"joinTokenTitle": "Cluster join token",
|
||||
"joinTokenOneShot": "Shown once, usable once",
|
||||
"joinTokenOneShotDesc": "Transfer the token securely now — it won't be shown again. Valid until {{expires}}. Server marks it as consumed when redeemed via cluster-join.",
|
||||
"joinTokenFailed": "Token generation failed",
|
||||
"joinCmdLabel": "Run on the new node:"
|
||||
},
|
||||
"ssl": {
|
||||
"title": "SSL certificates",
|
||||
@@ -337,23 +446,113 @@
|
||||
"issueButton": "Issue certificate",
|
||||
"uploadButton": "Upload",
|
||||
"issueSuccess": "Certificate issued + installed.",
|
||||
"renewBtn": "Renew",
|
||||
"renewConfirmTitle": "Renew certificate now?",
|
||||
"renewConfirmDesc": "Triggers an ACME HTTP-01 challenge for {{domain}}. Let's Encrypt has rate limits (50 issues/domain/week) — only use when needed.",
|
||||
"renewSuccess": "Certificate renewed + installed.",
|
||||
"renewFailed": "Renewal failed",
|
||||
"uploadSuccess": "Certificate uploaded + installed.",
|
||||
"deleteConfirm": "Delete certificate for {{domain}}? HAProxy falls back to the default cert for this domain.",
|
||||
"installedTitle": "Installed certificates",
|
||||
"lastRenewed": "Last renewed",
|
||||
"statTotal": "Certificates total",
|
||||
"statExpiring": "Expiring < 30 days",
|
||||
"statExpired": "Expired",
|
||||
"statErrors": "With errors",
|
||||
"relAgo": {
|
||||
"justNow": "just now",
|
||||
"minutes": "{{n}} min ago",
|
||||
"hours": "{{n}} h ago",
|
||||
"days": "{{n}} d ago"
|
||||
},
|
||||
"emptyTitle": "No certificates installed yet.",
|
||||
"emptyDesc": "Use the tabs above — Let's Encrypt issues automatically via HTTP-01 challenge, or upload your own PEM. Until then HAProxy serves the bootstrap self-signed cert for all domains.",
|
||||
"certPem": "Certificate (PEM)",
|
||||
"chainPem": "Chain (PEM, optional)",
|
||||
"keyPem": "Private key (PEM)"
|
||||
},
|
||||
"settings": {
|
||||
"title": "Settings",
|
||||
"intro": "System information and setup status. Editable values come in a later release.",
|
||||
"intro": "System information, setup status and admin account.",
|
||||
"systemInfo": "System",
|
||||
"version": "Version",
|
||||
"status": "Status",
|
||||
"dbSize": "PostgreSQL DB size",
|
||||
"dbSizeTop": "Top tables",
|
||||
"upgradeStatusCardTitle": "Last upgrade attempt",
|
||||
"upgradeStatusStarted": "Started",
|
||||
"upgradeStatusFinished": "Finished",
|
||||
"upgradeStatusResult": "Result",
|
||||
"upgradeStatusState": "State",
|
||||
"upgradeStatusOk": "Successful",
|
||||
"upgradeStatusShowLog": "Show full log ({{n}} lines)",
|
||||
"actionsCardTitle": "System actions",
|
||||
"actionsHint": "Manual triggers for operator tasks that normally happen automatically on save in the respective pages. Useful after SSH interventions (e.g. /etc/edgeguard/tls/ filled manually).",
|
||||
"haproxyReloadBtn": "HAProxy reload",
|
||||
"haproxyReloadOk": "HAProxy reloaded.",
|
||||
"haproxyReloadFailed": "HAProxy reload failed",
|
||||
"renderConfigsBtn": "Re-render configs (HAProxy)",
|
||||
"renderConfigsOk": "Configs re-rendered + reloaded.",
|
||||
"renderConfigsFailed": "Config render failed",
|
||||
"backupNowBtn": "Backup now",
|
||||
"serviceRestartCardTitle": "Restart services",
|
||||
"serviceRestartBtn": "Restart",
|
||||
"serviceRestartOk": "{{service}} restarted successfully.",
|
||||
"serviceRestartFailed": "Restart of {{service}} failed",
|
||||
"serviceRestartHint": "Restarts the service via systemctl restart. edgeguard-api and PostgreSQL are intentionally excluded.",
|
||||
"backupNowOk": "Backup triggered — watch status on the Backups page.",
|
||||
"backupNowFailed": "Backup trigger failed",
|
||||
"setupInfo": "Setup",
|
||||
"adminEmail": "Admin email",
|
||||
"fqdn": "FQDN",
|
||||
"setupCompleted": "Setup completed"
|
||||
"setupCompleted": "Setup completed",
|
||||
"emailsCardTitle": "Contact emails",
|
||||
"adminEmailHint": "Used as the admin login identifier. Change requires a fresh login with the new address.",
|
||||
"acmeEmail": "ACME email",
|
||||
"acmeEmailHint": "Sent to Let's Encrypt as account contact. Existing certs are not affected — the next renew op registers the new address.",
|
||||
"emailsSaved": "Emails updated.",
|
||||
"emailsFailed": "Email update failed",
|
||||
"maintenanceCardTitle": "Maintenance mode (whole box)",
|
||||
"maintenanceOn": "Active — all customer domains return 503. Mgmt UI stays reachable.",
|
||||
"maintenanceOff": "Inactive — customer traffic is routed normally to backends.",
|
||||
"maintenanceMessage": "Maintenance message",
|
||||
"maintenanceMessagePlaceholder": "Service temporarily unavailable — we'll be back shortly.",
|
||||
"maintenanceMessageHint": "Returned in the body of 503 responses to end users. Plain text, max 500 chars.",
|
||||
"maintenanceHint": "Switches HAProxy on :443 into default-503 mode. Per-domain maintenance (Domains page) is overridden by this. Mgmt UI on :3443 is NOT affected.",
|
||||
"maintenanceSaved": "Maintenance mode updated.",
|
||||
"maintenanceFailed": "Maintenance toggle failed",
|
||||
"maintenanceActiveTitle": "Maintenance mode active",
|
||||
"maintenanceActiveDesc": "All customer domains currently return 503. Mgmt UI is reachable — customer traffic is NOT. Settings → Maintenance mode to disable.",
|
||||
"backupRetentionCardTitle": "Backup retention",
|
||||
"backupRetentionUnit": "backups",
|
||||
"backupRetentionDefault": "Default ({{n}} backups) — with daily schedule = {{n}} days of history.",
|
||||
"backupRetentionCustom": "Custom — the last {{n}} successful backups are kept; older ones are pruned after each backup run.",
|
||||
"backupRetentionHint": "0 = default (14). 1-365 = custom limit. Each backup is a full pg_dump + files tar (typically 50-500 MB). Reduce when /var disk gets tight.",
|
||||
"backupRetentionSaved": "Backup retention updated.",
|
||||
"backupRetentionFailed": "Backup retention update failed",
|
||||
"auditRetentionCardTitle": "Audit log retention",
|
||||
"auditRetentionUnit": "days",
|
||||
"auditRetentionDefault": "Default ({{n}} days) — audit entries older than {{n}} days are pruned daily.",
|
||||
"auditRetentionCustom": "Custom — audit entries are kept for {{n}} days.",
|
||||
"auditRetentionHint": "0 = default (90). 1-3650 (= 10 years) for compliance (SOX 7y = 2555, GDPR usually <= 365). Cleanup runs daily in the scheduler.",
|
||||
"auditRetentionSaved": "Audit retention updated.",
|
||||
"auditRetentionFailed": "Audit retention update failed",
|
||||
"autoUpdateCardTitle": "Automatic updates",
|
||||
"autoUpdateOn": "Enabled — edgeguard packages install automatically every day.",
|
||||
"autoUpdateOff": "Disabled — install updates manually via the banner.",
|
||||
"autoUpdateHint": "Whitelist covers edgeguard, edgeguard-api, edgeguard-ui only. Other packages stay under manual control. Requires unattended-upgrades (Trixie distro default). Conf file: /etc/apt/apt.conf.d/52edgeguard-auto-updates.",
|
||||
"autoUpdateToggled": "Auto-update setting saved.",
|
||||
"autoUpdateFailed": "Auto-update toggle failed",
|
||||
"passwordCardTitle": "Change admin password",
|
||||
"currentPassword": "Current password",
|
||||
"newPassword": "New password",
|
||||
"newPasswordHint": "At least 12 characters. Stored as bcrypt hash.",
|
||||
"confirmPassword": "Confirm new password",
|
||||
"changePasswordBtn": "Change password",
|
||||
"passwordChanged": "Password changed.",
|
||||
"passwordChangeFailed": "Password change failed",
|
||||
"passwordMismatch": "Passwords do not match.",
|
||||
"passwordMinLen": "Minimum 12 characters required."
|
||||
},
|
||||
"update": {
|
||||
"available": "Update available: version {{version}}",
|
||||
@@ -361,6 +560,8 @@
|
||||
"applyNow": "Install now",
|
||||
"confirmTitle": "Install update now?",
|
||||
"confirmDesc": "Packages will be updated to version {{version}}. edgeguard-api + scheduler restart (~2-5 s), HAProxy/nft/WG/Squid/Unbound/Chrony stay running.",
|
||||
"checkNowHint": "Refresh the server-side apt cache now and look for newer versions.",
|
||||
"updateReady": "Update ready: v{{version}}",
|
||||
"checkNow": "Check for updates",
|
||||
"checkDone": "Update available",
|
||||
"noUpdate": "No new updates",
|
||||
@@ -404,6 +605,10 @@
|
||||
"editServer": "Edit server tunnel",
|
||||
"addClient": "Add client tunnel",
|
||||
"editClient": "Edit client tunnel",
|
||||
"emptyServerTitle": "No WireGuard server tunnels yet.",
|
||||
"emptyServerDesc": "Server mode: this box listens on a UDP port and accepts peer connections (e.g. roadwarrior users, site-to-site branches).",
|
||||
"emptyClientTitle": "No WireGuard client tunnels yet.",
|
||||
"emptyClientDesc": "Client mode: this box connects to an external WireGuard server (e.g. HQ datacenter, cloud uplink).",
|
||||
"upstream": "Upstream peer",
|
||||
"deleteConfirm": "Really delete tunnel {{name}}? wg-quick will be stopped.",
|
||||
"keys": "Keys",
|
||||
@@ -430,6 +635,8 @@
|
||||
"add": "Add peer",
|
||||
"edit": "Edit peer",
|
||||
"deleteConfirm": "Really remove peer {{name}}?",
|
||||
"emptyTitle": "No peers in this tunnel yet.",
|
||||
"emptyDesc": "Add peers — each is a WireGuard identity (public key + allowed IPs). Server-generated keys give you config download / QR code for mobile clients in one go.",
|
||||
"keys": "Keys",
|
||||
"generateExtra": "If on: server generates a keypair for this peer and can hand out the config / QR. If off: paste the peer's public key only — no config download.",
|
||||
"pskExtra": "If on: server generates a 32-byte PSK for this peer.",
|
||||
@@ -471,7 +678,15 @@
|
||||
},
|
||||
"clusterCard": {
|
||||
"title": "Cluster",
|
||||
"nodes": "Nodes"
|
||||
"nodes": "Nodes",
|
||||
"modeSingle": "Single-Node",
|
||||
"modeCluster": "Cluster",
|
||||
"drift": "Config drift detected",
|
||||
"health": {
|
||||
"ok": "OK",
|
||||
"degraded": "degraded",
|
||||
"split-brain": "split-brain"
|
||||
}
|
||||
},
|
||||
"routingCard": {
|
||||
"title": "Routing",
|
||||
@@ -486,6 +701,15 @@
|
||||
"ifaces": "Interfaces",
|
||||
"wg": "WireGuard"
|
||||
},
|
||||
"alertsCard": {
|
||||
"title": "Recent alerts",
|
||||
"viewAll": "View all"
|
||||
},
|
||||
"onboardingTitle": "Welcome to EdgeGuard",
|
||||
"onboardingIntro": "Fresh box — here are the next steps to route customer traffic:",
|
||||
"onboardingStep1": "Create a backend pool (app servers behind HAProxy)",
|
||||
"onboardingStep2": "Add a domain (FQDN, assign primary backend)",
|
||||
"onboardingStep3": "Issue TLS certificate (Let's Encrypt HTTP-01)",
|
||||
"servicesCard": {
|
||||
"title": "Service status (live, 10s)"
|
||||
},
|
||||
@@ -510,6 +734,17 @@
|
||||
"title": "Time server (Chrony)",
|
||||
"intro": "Chrony as time-sync daemon (NTP). Sources on top, listen/serve config on the settings tab. With 'serve_clients' on and LAN-IPs bound, the box itself becomes an NTP server for the LAN.",
|
||||
"tabs": { "pools": "Sources", "settings": "Settings" },
|
||||
"statusCard": {
|
||||
"title": "Sync status (chronyc tracking)",
|
||||
"sync": "Synchronized",
|
||||
"synced": "Yes",
|
||||
"notSynced": "No",
|
||||
"source": "Source",
|
||||
"stratum": "Stratum",
|
||||
"offset": "Offset",
|
||||
"offsetHint": "Time difference to reference source. Values > 100 ms are unusual — check network or misconfigured source.",
|
||||
"loading": "Loading…"
|
||||
},
|
||||
"pool": {
|
||||
"kind": "Type",
|
||||
"kindPool": "pool — DNS round-robin (multiple servers from A records)",
|
||||
@@ -524,7 +759,9 @@
|
||||
"description": "Description",
|
||||
"add": "Add source",
|
||||
"edit": "Edit source",
|
||||
"deleteConfirm": "Really delete NTP source {{addr}}?"
|
||||
"deleteConfirm": "Really delete NTP source {{addr}}?",
|
||||
"emptyTitle": "No NTP sources yet.",
|
||||
"emptyDesc": "Without configured pool/server entries chrony falls back to its compiled-in default pool (debian.pool.ntp.org). Set custom pools for better time sync or internal stratum servers."
|
||||
},
|
||||
"settings": {
|
||||
"intro": "Global chrony settings. Saves reload chrony automatically.",
|
||||
@@ -560,7 +797,9 @@
|
||||
"records": "Records …",
|
||||
"add": "Add zone",
|
||||
"edit": "Edit zone",
|
||||
"deleteConfirm": "Really delete zone {{name}} and all its records?"
|
||||
"deleteConfirm": "Really delete zone {{name}} and all its records?",
|
||||
"emptyTitle": "No DNS zones yet.",
|
||||
"emptyDesc": "Unbound forwards everything to upstream resolvers by default. Add a zone to host internal FQDNs (internal.example.com) locally or set up an upstream stub for a foreign domain."
|
||||
},
|
||||
"record": {
|
||||
"name": "Name",
|
||||
@@ -572,7 +811,9 @@
|
||||
"drawerTitle": "DNS records",
|
||||
"add": "Add record",
|
||||
"edit": "Edit record",
|
||||
"deleteConfirm": "Really delete record {{name}}?"
|
||||
"deleteConfirm": "Really delete record {{name}}?",
|
||||
"emptyTitle": "No records in this zone yet.",
|
||||
"emptyDesc": "A/AAAA/CNAME/MX/TXT entries. Authoritative on local zones; on forward zones records here have no effect (upstream wins)."
|
||||
},
|
||||
"settings": {
|
||||
"intro": "Global resolver settings. Saves reload Unbound automatically.",
|
||||
@@ -608,7 +849,9 @@
|
||||
"comment": "Comment",
|
||||
"add": "Add ACL",
|
||||
"edit": "Edit ACL",
|
||||
"deleteConfirm": "Really delete ACL {{name}}?"
|
||||
"deleteConfirm": "Really delete ACL {{name}}?",
|
||||
"emptyTitle": "No forward-proxy ACLs yet.",
|
||||
"emptyDesc": "Default with no ACLs: only localnet (10/8, 172.16/12, 192.168/16) is allowed out. Add an ACL to selectively allow or block specific domains/IPs/ports."
|
||||
},
|
||||
"common": {
|
||||
"yes": "Yes",
|
||||
@@ -629,7 +872,9 @@
|
||||
"add": "Add",
|
||||
"download": "Download",
|
||||
"copy": "Copy",
|
||||
"copied": "Copied"
|
||||
"copied": "Copied",
|
||||
"close": "Close",
|
||||
"refresh": "Refresh"
|
||||
},
|
||||
"license": {
|
||||
"title": "License",
|
||||
@@ -678,6 +923,8 @@
|
||||
"addTitle": "Add static route",
|
||||
"editTitle": "Edit static route",
|
||||
"empty": "No managed routes yet.",
|
||||
"emptyTitle": "No managed routes yet.",
|
||||
"emptyDesc": "Static routes EdgeGuard installs on boot (e.g. to 10.0.5.0/24 via VPN gateway). Live routes above are read-only — what you add here persists.",
|
||||
"confirmDelete": "Really delete route to {{dest}}?",
|
||||
"refreshTooltip": "Reload live routes",
|
||||
"destExtra": "CIDR — e.g. 10.0.5.0/24 or 0.0.0.0/0 for the default route.",
|
||||
@@ -711,6 +958,10 @@
|
||||
"testDone": "Test sent — {{ok}}/{{total}} channels OK",
|
||||
"emptyChannels": "No channels. Add a webhook or an email.",
|
||||
"emptyEvents": "No alerts yet — triggers haven't fired any events.",
|
||||
"emptyChannelsTitle": "No alert channels yet.",
|
||||
"emptyChannelsDesc": "Without channels, fired events are only written to the database (Events tab) — nobody is notified. Add a webhook (Mattermost/Slack/Discord/custom) or an SMTP email.",
|
||||
"emptyEventsTitle": "No alert events yet.",
|
||||
"emptyEventsDesc": "Triggers (cert expiry, backup failure, cluster drift, license invalid, etc.) haven't fired any events yet. When they do, they land here and get delivered to the configured channels.",
|
||||
"noChannels": "no active channel",
|
||||
"confirmDelete": "Really delete channel {{name}}?",
|
||||
"col": {
|
||||
@@ -766,6 +1017,12 @@
|
||||
"scopeTitle": "What is backed up?",
|
||||
"scopeDesc": "DB dump (pg_dump --clean), setup.json, license_key, license.cache, .jwt_fingerprint, acme-account/. Generated configs (haproxy.cfg, nft, …) are reproducible from the DB and are NOT included.",
|
||||
"tabs": { "history": "Backups", "remotes": "Off-site targets" },
|
||||
"statLastSuccess": "Last successful backup",
|
||||
"statTotal": "Successful backups",
|
||||
"statSize": "Total size",
|
||||
"statFails24h": "Failures (24 h)",
|
||||
"statHoursAgo": "{{n}} h ago",
|
||||
"statDaysAgo": "{{n}} days ago",
|
||||
"runNow": "Run backup now",
|
||||
"created": "Backup created: {{file}}",
|
||||
"failed": "Backup failed",
|
||||
@@ -821,7 +1078,8 @@
|
||||
"filter": {
|
||||
"sources": "Select sources (all if empty)",
|
||||
"levels": "Filter levels",
|
||||
"grep": "Full-text search"
|
||||
"grep": "Full-text search",
|
||||
"reset": "Reset filters"
|
||||
}
|
||||
},
|
||||
"fwlog": {
|
||||
@@ -861,5 +1119,34 @@
|
||||
"dst": "Dest IP",
|
||||
"rule": "Rule ID"
|
||||
}
|
||||
},
|
||||
"audit": {
|
||||
"title": "Audit log",
|
||||
"intro": "Who changed what, when. Every mutation through the API (domain create, backend disable, cert issue, …) is recorded here.",
|
||||
"filter": {
|
||||
"actor": "Actor",
|
||||
"action": "Action",
|
||||
"subject": "Subject",
|
||||
"range": "Time range",
|
||||
"search": "Search",
|
||||
"reset": "Reset"
|
||||
},
|
||||
"col": {
|
||||
"time": "Time",
|
||||
"actor": "Actor",
|
||||
"action": "Action",
|
||||
"subject": "Subject",
|
||||
"detail": "Details"
|
||||
},
|
||||
"detailShow": "Show details",
|
||||
"empty": {
|
||||
"title": "No matches",
|
||||
"desc": "No entries matched these filters. Adjust or reset them."
|
||||
},
|
||||
"page": {
|
||||
"prev": "Prev",
|
||||
"next": "Next",
|
||||
"showing": "Row {{from}}–{{to}}"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user